Blog post id enumeration can lead to unwanted information disclosure

Re:Blog post id enumeration can lead to unwanted information... by dchest on Monday February 29, 2016 @11:54AM (#11196522)

Python's uuid4 is cryptographically secure, as far as I know. One UUID needs ~16 random bytes, my laptop's /dev/urandom gives about 14 MB/s (user-space PRNG can be much faster if needed).

Ah, Java...

[ Parent | on HN ]

Re:Blog post id enumeration can lead to unwanted information... by JoeAltmaier on Monday February 29, 2016 @12:24PM (#11196737)

To be cryptographically secure, it must be unguessable. That's a higher bar than random, because many random number generators are guessable (i.e. completely predictable).

[ Parent | on HN ]

Re:Blog post id enumeration can lead to unwanted information... by marcosdumay on Monday February 29, 2016 @06:10PM (#11199475)

Linux /dev/urandom is cryptographically secure.

The library you are using for creating those UUIDs must have some bug. My guess is they share the same generator for all threads on each machine.

[ Parent | on HN ]

Re:Blog post id enumeration can lead to unwanted information... by JoeAltmaier on Tuesday March 01, 2016 @01:30AM (#11201106)

From Wikipedia : "some people claim /dev/urandom as not recommended[who?] for the generation of long-term cryptographic keys"

[ Parent | on HN ]

Re:Blog post id enumeration can lead to unwanted information... by marcosdumay on Tuesday March 01, 2016 @07:38AM (#11202198)

It's manpage also says the same.

It is a cryptographically secure PRNG, but during a small time in system start up, it may not be correctly seeded.

If you need long term keys, it may be better to get some 256 bits from /dev/random before using /dev/urandom.

[ Parent | on HN ]

Re:Blog post id enumeration can lead to unwanted information... by dchest on Tuesday March 01, 2016 @08:14AM (#11202332)

That's a bad advice.

http://sockpuppet.org/blog/2014/02/25/safely-generate-random...

[ Parent | on HN ]